Original URL: http://www.theregister.co.uk/2013/04/11/spam_more_dangerous_than_ever/

Rotten spam causing more infections than ever – study

Indian and Vietnamese kinds are the worst

By Neil McAllister

Posted in Security, 11th April 2013 23:46 GMT

Anti-spam tools have evolved to a degree where many of us hardly see much spam anymore. But when we do, the threat posed by those messages is greater than it has ever been, according to a new report from independent security firm AV-Test.

The report, entitled "Spam – More Dangerous than Ever Before," was based on an 18-month study conducted between August 2011 and February 2013, in which AV-Test harvested and analyzed some 550,000 spam emails.

As in the past, the vast majority of those messages contained fraudulent offers for counterfeit products, such as bogus pharmaceuticals. Being ripped off is the main risk there, not to mention phishing.

But around 2.5 per cent of the spam being sent today serves a different, darker purpose, the report claims – namely, spreading malware.

Certain types of spam emails are especially dangerous. Of the 30,000 spam messages AV-Test analyzed that contained attachments, over 10,000 of them – nearly a third – were infected with malware.

The file formats used to deliver the payloads were mostly the usual suspects. ZIP attachments and executable formats such as EXE and PIF were almost always infected, as were 80 per cent of HTML documents sent as attachments. PDF and image attachments were occasionally found to contain exploits, too.

Less prevalent, but much harder to spot, were messages containing links to websites that spread malware. Only around 1 per cent of the spam that included URLs contained such links, but such messages are often indistinguishable from those containing more benign links.

But not all spam is created equal. In particular, country of origin matters when determining whether a message is likely to contain malware.

As with other studies, AV-Test found that the majority of all spam sent originates in the United States, including spam messages containing attachments. But only 15 per cent of spam attachments sent from the US were actually malware, compared to 30 per cent globally.

On the other hand, spam attachments sent from India were infected 78 per cent of the time, while runner-up Vietnam sent attachments that were infected 77 per cent of the time.

Predictably, nearly all of the spam analyzed was sent by PCs that were remotely controlled by botnets. What may be surprising, however, is that some 25 per cent of these spambots only operated Monday through Friday.

According to AV-Test, that indicates they were located in offices, where PCs were switched off over the weekend – "even in Germany!" the German firm breathlessly reports, though it hastens to add that Teutonic spam was less likely to contain malware.

So what's to be done about all this? The usual cautions apply. Incoming email should be filtered for spam, and PCs should have good antivirus software installed to prevent infection by Trojans and rootkits, should an infected message happen to get through.

In addition, the AV-Test report notes that the German government and an association of local businesses have created a website containing links to tools that can help users check whether their PCs belong to a botnet. ®